[gnumeric] xlsx: fix crazy memory allocation. [#650639]

[Morten Welinder <mortenw src gnome org>]

commit 0d3458859b44b0e7687b63163e5729c6c851205a
Author: Morten Welinder <terra gnome org>
Date:   Fri May 20 16:15:43 2011 -0400

    xlsx: fix crazy memory allocation.  [#650639]

 NEWS                       |    1 +
 plugins/excel/ChangeLog    |    8 ++++++--
 plugins/excel/xlsx-write.c |    2 ++
 3 files changed, 9 insertions(+), 2 deletions(-)
---
diff --git a/NEWS b/NEWS
index f3636a5..c1a0ea8 100644
--- a/NEWS
+++ b/NEWS
@@ -34,6 +34,7 @@ Morten:
 	* Fix problems reading some Lotus 1-2-3 files.
 	* Fix paste-special repeat.
 	* Fix ADDRESS problem.
+	* Fix xlsx write problem.  [#650639]
 
 Urmas:
 	* Initial support for Works files.  [#647492]
diff --git a/plugins/excel/ChangeLog b/plugins/excel/ChangeLog
index e70f243..45a8c4f 100644
--- a/plugins/excel/ChangeLog
+++ b/plugins/excel/ChangeLog
@@ -1,3 +1,7 @@
+2011-05-20  Morten Welinder  <terra gnome org>
+
+	* xlsx-write.c (xlsx_write_rich_text): Clamp "start" too.
+
 2011-05-03  Andreas J. Guelzow <aguelzow pyrshep ca>
 
 	* ms-chart.c (chart_write_LEGEND): use
@@ -18,10 +22,10 @@
 
 2011-05-03  Jean Brefort  <jean brefort normalesup org>
 
-	* xlsx-read-drawing.c (xlsx_style_line_start): don't crash on NULL 
+	* xlsx-read-drawing.c (xlsx_style_line_start): don't crash on NULL
 	style,
 	(cb_axis_set_position): fix axis crossing position.
-	* xlsx-write-drawing.c (xlsx_write_chart): partially fix circular 
+	* xlsx-write-drawing.c (xlsx_write_chart): partially fix circular
 	axis position.
 
 2011-04-08  Jean Brefort  <jean brefort normalesup org>
diff --git a/plugins/excel/xlsx-write.c b/plugins/excel/xlsx-write.c
index 9a7057f..73bbf1d 100644
--- a/plugins/excel/xlsx-write.c
+++ b/plugins/excel/xlsx-write.c
@@ -982,6 +982,8 @@ xlsx_write_rich_text (GsfXMLOut *xml, char const *text, PangoAttrList *attrs)
 		pango_attr_iterator_range (iter, &start, &end);
 		if (end > max)
 		    end = max;
+		if (start > end)
+			start = end;
 		buf = g_strndup (text + start, end - start);
 		gsf_xml_out_add_cstr_unchecked (xml, NULL, buf);
 		g_free (buf);